OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows una…

A path traversal vulnerability exists in OpenWrt's luci-app-bmx7 package prior to commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd. The flaw resides in the bmx7-info CGI script and allows unauthenticated attackers to read arbitrary files outside the configured runtimeDir. Exploitation is achieved by supplying directory traversal sequences in the HTTP query string, enabling escape from the intended directory boundary. Sensitive files accessible to the CGI process can be read without any authentication. The vulnerability affects OpenWrt routers and embedded devices running the affected luci-app-bmx7 package. A fix has been committed and is referenced by the specific commit hash. The issue is documented in a GitHub Security Advisory and a VulnCheck advisory. No active exploitation has been publicly confirmed at this time, but the unauthenticated nature of the attack raises the criticality level.